CMMC Software Approval Methodology

1. A Two-Phase, Fail-Fast Pipeline

DigVel uses a Zero-Trust, two-phase pipeline to evaluate third-party software without risking your internal network. The pipeline is built around a "fail-fast" principle: if an application is going to be rejected, we want to find out — and stop — during the cheap, fast Phase 1, before any sandbox time is spent on it.

2. Phase 1 — OSINT & Compliance Screening

Before running any code, our analysts investigate the vendor's geopolitical and compliance footprint:

• Screening the developer against OFAC and US Entity Sanctions lists to mitigate Foreign Ownership, Control, or Influence (FOCI) risk.
• Hunting for a Vulnerability Disclosure Program (VDP) or an equivalent legal channel for reporting security issues.
• Reviewing historical CVEs and how quickly the vendor has remediated them.
• Verifying accreditations (SOC 2, ISO 27001, FedRAMP) and general infrastructure hygiene.

If a vendor is sanctioned, or another blocker is found, the process stops here with a Denial Report — saving you the cost and wait of a full sandbox analysis on software that was never going to pass.

3. Phase 2 — Sandbox Dynamic Analysis

Software that passes Phase 1 is transferred to a strictly isolated, air-gapped cloud sandbox. Our engineers execute the installer and monitor its behavior at the system level:

• Intercepting HTTP/HTTPS traffic to confirm there's no Command & Control (C2) beaconing.
• Tracing the execution flow to catch spawned child processes and living-off-the-land binaries (LOLBins).
• Monitoring filesystem and registry modifications, including persistence mechanisms.
• Cryptographically validating the trust chain of the installer and every dropped dependency.

Once telemetry is captured, the sandbox environment is permanently destroyed. The findings become the technical basis of your audit-ready report, including a hardening blueprint and a mapping to the specific NIST SP 800-171 controls the software supports.

4. What Qualifies as a Standard Application

To guarantee our fixed SLAs and transparent, flat-rate pricing, we define what counts as a "Standard Application" up front.

Covered by standard Tier 1 / Tier 2 pricing:

• Standard desktop applications: utilities, engineering viewers, PDF editors, IDEs, office productivity tools.
• Software that runs in standard Windows User-Mode (Ring 3).
• Standard installer formats (MSI, Inno Setup, Nullsoft, WiX) or portable applications.
• Freeware and open-source software with no mandatory paywall.
• Commercial software with a fully functional, publicly downloadable trial.
• Target OS: Windows 10/11 (64-bit).

Requires Tier 3 custom scoping: kernel-mode drivers (Ring 0), complex multi-tier platforms (ERP, database clusters), proprietary/gated software requiring a license or KYC to even download, hardware-dependent software (dongles, PLCs, ICS/SCADA), source-code review (we perform black-box dynamic analysis, not line-by-line static review), and mobile/macOS applications.

5. Shared Responsibility Model

DigVel operates under a shared responsibility model. We provide the assessment and audit-ready evidence; your internal IT team implements the resulting policy:

• Policy enforcement — we provide the exact hashes, network indicators, and technical justification; your administrators implement them in your own endpoint protection platform (e.g. AppLocker, ThreatLocker, Microsoft Intune).
• Continuous monitoring — our report is a point-in-time assessment. Your SecOps team remains responsible for ongoing threat-intelligence monitoring after the report is issued.
• Patch management — if our hardening blueprint identifies a required dependency update, your IT team is responsible for deploying that patch.
• Source code review — we perform black-box dynamic analysis (DAST) and behavioral monitoring, not line-by-line review of proprietary vendor source code.